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Abstract 

A system and method of unique personal identifier that can be generated de 
novo by one or a plurality of professionals, working incommunicado and separated by 
time and space, based on information that can be readily supplied by the patient or client, 
informant, governmental records or birth certificate - with the resultant key generated 
being the same and unique for that person enabling the cross-referencing , retrieval and 
merging of data collected pertaining to that person in a health care or non-health care 
context. 



The integrity of the personal identifier of this invention is ensured by continual 
professional verification at the service delivery level. A system and method of resolving 
non-unique keys is also discussed. This invention allows the professional/ health care 
practitioner or his staff to generate a unique patient identificaaon key suitable for 
personal healthcare informatics and/or knowledge management purposes ( such as 
crime fighting bureau) regarding a person living or deceased, based on data that the 
person, or his relatives, or an extract of a birth certificate, or historical records can 
provide. Data ofa personal and geographical nature embedded in person health id will 
also aid in public health research and personal healthcare. Personal ID keys so generated 
by a plurality of health practitioners / governmental bureaucracies will enable the sharing 



of da la / medical record transaction,. If properly knplemented will guarantee that no two 
natxonals in a country will ever have the same LED which is a personal/patient health 
Identifier key . A unique personal identifier for each person bom on this earth both living 
and deceased is helpful for knowledge management concerning that person and is 
applicable for function such as implementing universal personal TD system personal 
web site/email address and for tracking data for knowledge management such as for law 
enforcement purposes. It will also stem the tide of personal ID theft. 
The problem 

The patient in a modern society has ample access to a multitude of care providers which 
may comprise several family doctors, several pathology and radiological laboratories and 
several medical specialists. Healthcare is expensive and duplications of tests, drugs, 
procedures and sequestration of patient health data by individual healthcare provider wffl 
mevitably lead to wastage and sub-optimal care. Synchronisation of distributed medical 
data can only be promoted by a unique patient identifier, but unfortunately each health 
care provider generates its own unique identifier and has its own method of transactional 
representation. At each site of care, recording of patient data occurs, this data being 
usually stored in a computer database. At each site, data pertaining to a particular patient 
is assigned a unique patient identifier that is unique to that particular healthcare 
organization. Healthcare in the 21st century is about universdiaation, collaboration, 
aggregation and translation of medical data pertaining to a particular patient across all 
geographical and care-provider boundaries- to make the health data available anywhere 
at any ume to accredited care providers. A significant problem, then, i s the lack of a 
pWer-verifiable universal patient identifier for lagging transactions, to which the 
proliferation of Medicare care card numbers bears testament. 

The government in Australia, as in other jurisdictions, is unwiUing or unable to introduce 
a nationwide unique patient identifier for th e specific purpose of inter-operabihty and 
transportability of partial or whole medical records/transactions across the various 
healthcare sectors. The Dode coding system, based on the biological Linnean 
classification system, is the most widely used coding system in general practice in 
Australia(>l 5 ,000 GPs). The Dode paradigm acts a powerful filter for problem soMng 



m this particular domain. The present invention includes a system and method of patient 
unique identifiers based on Lirmean Classification ao d geographical information- which 
can be supervised by the various general practitioner divisions under the auspices of the 
JtACGP/ADGP - providing the foundational backbone for an effective de fecto national 
unique patient ID system. 



The system below is a prior art attempt by the author to solve the 
patient identifier problem. 

The method and system of the invention addresses the problem of a lack of unique patient 
identifiers. A lack of unique health identifiers have resulted in data islands in the 
healthcare scene. A dependence on national medical care numbers (eg Medicare numbers 
or NHS numbers) is unreliable, as such numbers are very difficult to readily verify 
consisting only of code numbers/characters. Increasing use of Medicare number has lead 
to greater entropy in the healthcare system. Studies by the inventor have concluded that a 
soluuon to the problem of patient identifiers should involve the participation of general 
practitioners, in conjunction with the appropriate admlrnstrative bodies to provide the key 
services of verification and maintaining the integrity of the system. In the first instance, a 
patient can choose to opt out of the system, in which case the uniqueness of these patient 
keys is resolved through the levels of the appropriate adniinistrative bodies. The system 
and method relies on naming rather than assigning strings of digits to a particular 
individual patient. 

Patient (species) naming conflicts are resolved by using the typical biblical naming series 
found in Matthew I :2 where is found the name series of "Abraham wasthe father of 
Isaac; Isaac was the father of Jacob- Jacob was the father of Judah; Judah was the father 
of Perez. . . (Taraar was his mother), . . " 

Naming conflicts, in the event that there were many of the name Perez in the particular 
community at that particular historical period, this can be resolved by naming this 
particular Perez as: 

perez_sJudah_tamarJacob_isaac_abraham where s means son of. 



« 

The framework of the linnean Dode paradigm of unique patient identifier views each 
patient as a unique individual requiring a species name. 

In the Docie classification framework there are primary, secondary and tertiary keys' e g. 
d,abetesMeliitus is a primary key, while the secondary key is diabm and the tertiary keys 
wmch are really aliases, such as "sugar.diabetes", or simply "diabetes". Ihthe proposed 
imnean ID system, the primary key for a given individual is yet to be developed at his 
tune, and when a national Patient ID is implemented, the linnean ID can be Its secondary 
key. Alternately this Wan key can be nominated the primary key. 

The linnean ID key incorporates the elements of first name, a computed number derived 
from the date of birth, the sex, the first names of father and mother and the first name of 
previous issue of either parents and the geographic location of birth designated by 
longitude and latitude. Given a hypothetical individual example, Robert was born on 1 7 
mar lo 88 whh father David and mother Alyce and registered by his family doctor He will 
be classified with the species name of 

robert3 1 8S2s@david@alyce.020606. vic.au 
the derivation of key being from: 

[first name at birth] [date of birth as expressed as number of days from 1 jan 
1901] [s|d] "@" [firstaame of father] «@ "[first D f mother] 
datcRegistration [state] 'V'[country] 

dateRegistration = yymmdd format 
This system is suitable for women who wish to change their surnames on inarrytag. 
The s| d option signifies V fbr son of, and *d' for daughter of 
A family OP is the 'registrar' of a particular key, responsible for the integrity and 
custodianship of the Linnean ID system. The <5P duties include sighting original 
documents, generating the Linnean ID, and educating the patient wife regard to the 
Unnean ID. Verification of patient identity is a responsibility GPs are traditionally used 
to. Tf appropriate, „ se of the identifiers can involve a small reward for each patient 
registration of the Linnean ID key, to both doctor and patient, due to the savings 
generated from increased efficiency of process arising out of this use. 



In the extremely rare event that there is another individual with the same administrative 
data as Robert in that same division, then the key Is simply resolved on the following 
registration day: 

robert3 1852s@david@sryce.020607.vic.au 

The division collects information in a data table (a relational database) comprising only 
three fields: the Unnean ID key, the attribute of Ihe registrar (the provider number), and 
the national medical care number (eg Medicare number) of the patient (if available). 
Before a new Linnean ID is created , a check is made on the national database for 
duplication or ID. For example if another GP in the Dandenong division attempts to enrol 
Robert, the national database check will indicate that Robert is already enrolled in the 
Knox division via information regarding Medicare number and date of birth. 

The system is designed to maintain fitfl integrity. The database at the general practitioner 
divisional level can be uploaded to a regional divisional office (eg the state divisional 
office). Duplicates are detected by looking for records with the same date of birth- 
computed number, and the same medical number, as well as by other checks. Intentional 
and unintentional risks of system corruption can be detected by a doctor unable to match 
pathology results and hospital discharge notes. In this way, patients can be taught to value 
the advantages of a safe and accurate TD that has as its sole aim improved health 
outcomes. The integrity of the system is maintained by constant use, and dubious 
Medicare numbers will be exposed by such use. 

Currency and integrity of each key can be certified periodically by the GP or approved 
health care provider. 

The system deals with Linnean ID key deprecation in this way. The division at national 
level constructs a table of deprecated keys, being keys that will never be used again. Each 
deprecated key will point to the current Linnean ID. Doctors and patients involved in any 
key deprecation are informed by the division. The system is thus designed to withstand 
key deprecation. 

The following gives fiirtber information on the Linnean classification of patients: 
kingdom: objectMedica 



phylum: tamtap 

genus: robert* 33673* d A fbther@david- mother@alyo^ 020606. via au* 
species: robertl 1 852s@david< 



Comment; die Linnean Id belongs to the polygeuera of : robert A 33679* & A d* 
father@4avid A mother^alyce^ 020606. vie. au^ 

The Linnean ID system will pick u p most if not all incongruencies in entries. The 
enhanced reliability and efficiency of the system will tend to encourage buy-in from all 
stakeholders in the medical community. It is commonly understood that 20% of our 
patients make more than 80% of healthcare demands, if the system can concentrate on 
the healthcare needs of this 20 percent, and demonstrate the fairness and integrity of the 
system, the rest of the population will buy in. 

Analysis of strength and weaknesses of above system; 

The above system sutlers from the weakness of the variable date of registration and the 
lack of usefulness of data related to the location of registration process. The other 
weakness is the reliance on a central authority to act as a referee to guarantee the 
uniqueness of the patient Lbinean identifier key. In this invention the reliance on a central 
authority to warranty the uniqueness of the key is dispensed with. This invention 
comprises means for any doctor, general practioner, specialist or health worker to work 
in complete autonomy at any time or space to compute and derive the same unique 
patient linnean identifier key based on data that is easily obtained from patient or 
informant or is held in the modern birth certificate. The improvements are enhancements 
to the above Bnnean system and allows the clinician or his support staff to issue a unique 
patient identifier key with confidence and zero reliance on a central control authority. 



Improved system and method of personal Linnean ID system of mis 
invention 
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The method below uses a previous issue of parent and geographical disoriounator . This 
method allows doctors working in disparate location* / time and incommunicado to 
generate the same identifier keys and solve the data island problem. The derivation of key 
being from: 

[first name at birth] [date of birth as expressed as number of days from J jan 

1901] [s|dj [first name of father] x '@ "[first name of mother] [first 

name of previousjssue _ofparents] [latitude of place of birth] [longitude of 
place of birth] 

first name of previous issue of parents = name of your youngest older brother or sister, 
either mother or father side - or as the case maybe same lather and mother . In the case 
of say a family of 5 children with same father and mother ( both with no other children) 
from other relationships ) enumerated from eldest to youngest: Jack, Jfll, John, Jerry and 
Jeremy: the pxevious_issue_of_parents of John is Jill and the previous issue kin of 
Jeremy ts Jerry and the previous issue kin of Jack is nil. 



For example: 

The scenario of Robert was born on 17 mar 1 988 with father David and mother Alyce. 
Robert is the first bom of both David and Alyce. Robert was born in Geelong, Australia 
which has the geographic location of latitude 38.08 south and longitude 144.21 east He 
is being registered by his family doctor in the following manner : 

The dtodorfstaff member will type in the following registration screen: 

REGISTRATION SCREEN 

first name: Robert 

surname: Oon 

middle name: Tongsheng 

fathers first name: David 



mothers first nanus: Alyce 

birthday: 17 mar 1988 
sex: in 

kiti first name - previous issue of parents: nil 
location/town: Geclong 

On clicking "register" the computer program will ignore the surname and middle name; 
will compute that 17 mar 1988 is 3 1 852 days since 1 Jan 1900. 

The computer program will lookup Geelong in Us geographic database and return the 
string comprising latitude and longitude to degress and minutes in precision. 
38,08sl44.21e 

He will be classified with the species name of: 

robert3 1852s@david@alyce38.08sl44.21 e 



The occurrences of just 2 @ characters indicates that Robert above is the first or eldest 
child of both Alyce and David. 

I n the hypothetical example of Robert being actually the second child and that he has 
older sister named Nicole, with all other data unchanged, then the key would be- 



an 



robert3 1 852s(^avid@alyce@nicole38.08sl44.2 1 e 



In another embodiment, which is the preferred default system and method, for the GPS 
location of birth, only the graticule readings apply. That is using the longitude and 
latitude with degrees data only without the minutes and seconds data. 

the concept ofgraticule of dimension 1 degree latitude by 1 degree longitude isused. 
Everyone horn m this world is geographically linked to a particular graticule on this 
earth. A graticule varies from a maximal size of 1 1 1 km by 1 1 1 km at the equator area to 
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an area less thai 1 00 by 70 km near the pole. A graticule is a grid of meridians and 
parallels derived from a particular projection, used to drawing the map. The system used 
is based on modern map making predicated on the system of 1) latitude with the equator 
being zero degrees and latitudes are designated as north or south oFthe equator. Near the 
equator each degree change is about 11 1 km 2) longitude based on the Greenwich 
meridian being zero degree and that meridians are designated as degrees 0 to 179 east or 
west - where 180 degree east is equivalent to ISO degree west. The meridians get 
squeezed together at the poles, hence graticule . Any location in the world can be 
assigned a graticule defined by the latitude and longitude expressed as degrees but 
without the minutes or seconds. For example Melbourne geographic position is 38.085 
144.21E, hence is graticule is defined by latitude in the range 38.0.0 S to 39.S9.59S and 
longitude 144.0.0EIO 144.59.59 E 

Hence in the above example of Robert above, without any older sibling, using the 
graticule concept: 



robert3 1852s@david@alyce38sI44e 



and in the case that with Nicole as the immediate older sister: 



robert31852s@david@alyce@nicole385]44e 



Guarantee of uniqueness of patient LID. 

There are at least 2 ways of avoiding non-uniqueness of patient Linnean identifier. 
While the chances of a non-unique key are close to zero, a system to ensure uniqueness 
can be effected at the registry of birth level. All birth certificates that are issued at the 
state level have to pass the patient LTD test before they are issued. It is extremely 
unlikely but in the era of electronic i*cord keeping of births, the overhead is almost zero 
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' wMe re ^ 5tr y of Js at * . « might as well compute the patient LID and stamp it on 
the extract of the registry of birth . 

In the event of a patient LTD conflict, there are a number of ways of resolving the naming 
conflict. Parents are informed that registration is on a first in best dressed system. In one 
scenario the registry of birth can act like an internet domain registry and scoff at the 
parents for daring to register their baby with a patient LID that is already taken and 
threaten them with removal of privileges if they do not get a valid LID. Towards must not 
be given to induce parents to change their baby name to avoid naming conflict* as this 
will lead to rorts. 

The easier way is to get a more accurate GPS ( Geographic Positional System) exposed 
in degrees, minutes and possible seconds if need be to avoid key conflict. 

For example the key below, in the remote possibility that it may be non unique : 
robert3 1 852s@david@alyce@nicole38.08sl 44.21e 



can be resolved by a more accurate GPS system to resolve the location of the 
hospital/suburb of the confinement centre may generate a more detailed key utilising 
seconds information for the GPS such as: 

roberO 1 852s@david@al>-ce@nicole3S.08.44sl44-21 .12e 



Note: each second change in a longitude and latitude graticule in the Australian 
subcontinent of say 100km X 100km approximates to 100/60 or L66 km - a distance 
that is enough to distinguish tire different location of two hospitals that are set more than 
2 km apart. 



System and method. 



The graticule system is preferred solution as the data needed to generate the patient LID 
can be provided by a conscious patient/informant without to recourse to look up birth 
certificates/document. Use of geographic information utuismg tmnutes and seconds are 



11 



required only to resolve key conflicts. Most atlases give conflicting minute readings for 
GPS refernces tor big cities. Where is the centre point of a big city Jike New York or 
Beijing. The GPO as a reference point may be fraught with doubt. The general post office 
(GPO) in a city may be destroyed and redeveloped as a commercial centre. So when a 
client says he is from Calcutta, it is betler to use the graticule ( in degrees only) from 
Calcutta rather than a longitude and latitude reading with both degrees and minutes from 
a reference atlas/Kst. Longitude/latitude readings in degrees, minutes and seconds may 
be used to resolve problem of uniqueness of keys OR in instances of birth certificates 
contain precise GPS locations and the use of minutes and seconds is mandated by 
government for purpose of public health in locating more precise location of birthing 
centres for epidemiological reasons. 



The view of the General practitioner is that of a "gate keeper" to prevent wasteful access 
of the health system. In this proposal, the general practitioner, in providing the 
registration and verification services needed - becomes the goal scorer in a national ID 
system.. A universal patient id, compliant with all aspects of current (and designed to 
cope with future) privacy legislations, is needed in the relentless pursuit of quality, 
equality and efficiency for best patient population outcome - in a healthcare system 
with limited resources. Grass roots verification provided at the professional service level, 
with the aim of benefiting patient by not losing health data, will lay the foundation for a 
system of identity of the highest integrity. A system of integrity which may be called 
upon for the service of the nation in the event of that need. 
The graceful degradation of medical transaction 
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Dr Y Kuaog Oon 

Prepositional Medical Recording Group, Bode Systems, docle@compuserve.coin 

21 March 2003 

Abstract 

Computerising the medical transactions can create a gold mine for epidemiological 
research if each and every medical transaction carries with it, two instances of embedded 
GPS information. The two GPS locations of interest being 1) the location of birth of the 
patient and 2)the location of current iUoess/health contact as represented by the location 
of the provider. In DocleScript transactions, which are typically held in a SQL database, 
these data are embedded in a transparent manner in the patient identifier. 
Tn the DocleScript prepositional recording system, the location of birth-GPS data of the 
patient is embedded in its Connectionless Universal Patient Identifier (CUPID). Cupid 
also incorporates embedded data relating to date of birth, sex, first names of parents, 
birth order among other data. In the DocleScript medical recording system, all medical 
transactions are based on the concept of propositions. A proposition is the reification of 
the meaning of a declarative statement on the patient's health and administrative status. 
Included in any DocleScript medical proposition, besides the CUPID, is an author field 
with a provider number with a concatenated GPS location after the apropos character. 
For example provider 77777FX located in Geelong would be 7777FX@1 1.34nl44.55e. 
Provider GPS locations with 1 second difference,, depending on the latitude, will 
translate to a distance of approximately 1.6 km, a suitable order of magnitude to 
pinpoint a suburban salmonella epidemic. While GPS locations with degree of accuracy 
to 1/60 or 1/100 of a second will be able to pinpoint specific birth centres and would be 
ideal for perinatal research. With these embedded GPS data, detection of unusual 
epidemiologic phenomena, instances of doctor shopping and other systematic abuse of 
the health care system would be facilitated. 

It is a given that a standardized medical transaction has to include a universal ID key and 
an author key for purposes of remoting and reaggrcgation. By persuading/mandating the 
use of embedded GPS data in the Patient ID key such as in the CUPID system, and the 
incorporation of GPS data in the author key, we would have come a long way in 
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unlocking the gold mine within the electronic health record to the public health 
researcher. 

In another scenario this GPS aware CUPID key is used for cross-matching the 
compatibility of two medical records, with a probabilistic score, before they are merged. 
This cross matching of the CUPID patient identifiers is a classic example of its "graceful 
degradation" attribute in that a small error in the CUPID patient identifier does not lead 
to rejection of the transaction but evokes a "immunologic" type system response to 
attempt to correct the defect. 

An example of two cupids: 

1) yeongl9191s@thean@sook@yongj|2nl44e 

2}yongl 9191 s@thein@seok@y ong 1 2,44n 1 44 . 1 2e 

would be processed with a CUPID cross-matcher which would output score of 82 out of 
100 for degree fit Heavier weightings can be placed on date of birth and geographic 
location of birth while minor spelling errors in relation 9 s first names are better tolerated. 

While the fbloowtng two cupids: 

1) yeong 19181 s@thean@sool*:@yong 1 2ul44e 

2) yongl 9 19l8@thein@seok@yongl2.44nl44. 12e 

would attract a score of only 14 as the date of birth misses the mark. 

By using the CUPID cross matcher the system will present the likeliest candidates that 
can lay claim to the imported transaction - to be followed by human eye verification. 



CLAIMS 



14 



lAunique person identifier system and method mat can be generated de novo by 
professionals incommunicado and separated by time and apace , based on the 
information can be readily supplied by the patient or client, informant, governmental 
records or birth certificates ; is predicated on first names of the person, the father, the 
mother and if applicable the first name of previous Issue of either parent, a computed date 
of birth, sex and a geographical location expressed in longitude and latitude - with the 
same id entifier key bebg generated, to allow merging of data collected regarding that 
person in a health care or non- health care context. 



2. The personal identifier system and method that comprises means to resolve 
uniqueness of identifier by expanding onthat component of identifier relating to 
geographical positioning system, through extending the graticule by the incorporation 
of minutes and if need be, seconds data to the identifier. 



3. System and method to allow cross-matching of connectionless universal patient 
identifier for degree of match, allowing for graceful degradation, and comprising means 
for system to rectify the discrepancy in personal identifier by evoking likely candidates 
who are the real owner of an imported medical transaction. 



Glossary 



LID - linnean identifier , a unique key to tag patient data such as database transactions 
and medical files. 



OPS - Geographic Positioning System 
^Enhancements 

< 

3 feb 03 

- docking based on probabilistic model 6nl00e is near fit to 6.32n100.2le 



-service location as 6J2ji10(X2 I e 
-home location of patient is 6J2«10O.21e 
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